24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ae,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSILHeracles.Generic Sample 6b872d1e949b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6b872d1e949b…. Malware family: MSILHeracles.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6b872d1e949bd9d111168692301414bb685dc5c262ffae6f55f34c8041de0f5f","keywords":["Malicious","MSILHeracles.Generic","malware analysis","sandbox report","threat intelligence","6b872d1e949bd9d111168692301414bb685dc5c262ffae6f55f34c8041de0f5f"],"about":{"@type":"SoftwareApplication","name":"image293.jpg.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"6b872d1e949bd9d111168692301414bb685dc5c262ffae6f55f34c8041de0f5f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSILHeracles.Generic","antivirusDetections":{"malicious":18,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T419,"" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00015612-00003496-0000010C-43612194 "" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00015612-00003496-0000010C-43612320 "" queries volume information of "C:\" at 00015612-00003496-0000010C-44941671 "" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Templates\steamerrorreporter.exe" at 00015612-00003496-0000010C-44944212 "steamerrorreporter.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00016245-00003716-0000010C-45472134 "steamerrorreporter.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00016245-00003716-0000010C-4547228626:T645,"" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\assembly\NativeImages_v2.0.50727_32\index23c.dat" "" touched file "C:\Windows\System32\l_intl.nls" "" touched file "C:\Windows\assembly\pubpol47.dat" "" touched file "C:\Windows\System32\rsaenh.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll"27:T5a0,"" opened "C:\6b872d1e949bd9d111168692301414bb685dc5c262ffae6f55f34c8041de0f5f.exe:Zone.Identifier" with delete access "" opened "C:\Users\1z0vVgf\AppData\Roaming\Microsoft\Windows\Templates\steamerrorreporter.exe" with delete access "" opened "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.3496.3758417" with delete access "" opened "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.3496.3758417" with delete access "" opened "C:\Users\1z0vVgf\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.3496.3758487" with delete access "steamerrorreporter.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Templates\steamerrorreporter.exe:Zone.Identifier" with delete access "steamerrorreporter.exe" opened "C:\Users\1z0vVgf\AppData\Roaming\Microsoft\Windows\Templates\steamerrorreporter.exe" with delete access "steamerrorreporter.exe" opened "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.3716.1570629166" with delete access "steamerrorreporter.exe" opened "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.3716.1570629166" with delete access "steamerrorreporter.exe" opened "C:\Users\1z0vVgf\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.3716.1570629216" with delete access28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8ABwAAAAAAEEAAcHAAcAAAB3d3d3d3d3d3d3d3d3d3cHd3d3d3F3d3czd3cxd3eHB3Bxd3B3AAAzMzdHd3cHdxFwd3cQFwAQQzN3R3d3AHcxMAAAAAAAAGQAFQAAAAAAAAAAAAAAAABEAAQAAAAAAAAQdwB3d3AHB3AHB3AHd3cHcAd3AAF3AAB3cAB3cAd3d3ABEQAAEQAAEQAAEQAHd3dwAXEAADMAADcAABcQAHV3EAAQAAAQAAABAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAdwBzdwAHZwAHB3AHd3AAcBd3MAd3cAd3cAB3cAB3dwABEQAAEQAAEQAAEQAAARAAARAAADMAADMAABMQABMwAAAwAAAxAAADAAADAAADEAAAAAAAAAAAAAAAAAAAAAAAMQAREwAHAwAHBxADATAAcHdzcAdzcQd3Nwd3NwB3N3ABEQABEQABERAAERAAERAAARAAABEAABEAABEAABEQAAAwAAARAAATAAADAAADEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEHdgc3dxdwdwBwdwBwN3A3AHZwABcxABdzAAdzAANzEAAAAAAREAABEAABEAABEQAABgAAARAAATAAATAAABEAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"6b872d1e949bd9d111168692301414bb685dc5c262ffae6f55f34c8041de0f5f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790422062414,"unified_at":"2026-09-26T11:27:42.414Z","metadata":{"hashes":{"sha256":"6b872d1e949bd9d111168692301414bb685dc5c262ffae6f55f34c8041de0f5f","sha1":"bce9ccb99887346ac11978501e2c2ce229821ef9","md5":"7b3815b9a90550cd55d471ca27924c59","sha512":"79992827e6b7f13140dd354079914a354aa0c4266ff571062b53dba241bfd3727aed266931ead3c0af45b8cfb44e275900a9073ea94f8d38da57b659495ac071","ssdeep":"12288:2ynpez/nuITmFGd9fdKPBd/xlYECsUh0cBiP/0sJvDwaYa:2ypejtTmFe9VqXSGBcBiP/0sBwaYa","ssdeep_chunks":["12288:2ynpez/","12288:ynpez/n","12288:npez/nu","12288:pez/nuI","12288:ez/nuIT","12288:z/nuITm","12288:/nuITmF","12288:nuITmFG","12288:uITmFGd","12288:ITmFGd9","12288:TmFGd9f","12288:mFGd9fd","12288:FGd9fdK","12288:Gd9fdKP","12288:d9fdKPB","12288:9fdKPBd","12288:fdKPBd/","12288:dKPBd/x","12288:KPBd/xl","12288:PBd/xlY","12288:Bd/xlYE","12288:d/xlYEC","12288:/xlYECs","12288:xlYECsU","12288:lYECsUh","12288:YECsUh0","12288:ECsUh0c","12288:CsUh0cB","12288:sUh0cBi","12288:Uh0cBiP","12288:h0cBiP/","12288:0cBiP/0","12288:cBiP/0s","12288:BiP/0sJ","12288:iP/0sJv","12288:P/0sJvD","12288:/0sJvDw","12288:0sJvDwa","12288:sJvDwaY","12288:JvDwaYa","24576:2ynpez/","24576:ynpez/n","24576:npez/nu","24576:pez/nuI","24576:ez/nuIT","24576:z/nuITm","24576:/nuITmF","24576:nuITmFG","24576:uITmFGd","24576:ITmFGd9","24576:TmFGd9f","24576:mFGd9fd","24576:FGd9fdK","24576:Gd9fdKP","24576:d9fdKPB","24576:9fdKPBd","24576:fdKPBd/","24576:dKPBd/x","24576:KPBd/xl","24576:PBd/xlY","24576:Bd/xlYE","24576:d/xlYEC","24576:/xlYECs","24576:xlYECsU","24576:lYECsUh","24576:YECsUh0","24576:ECsUh0c","24576:CsUh0cB","24576:sUh0cBi","24576:Uh0cBiP","24576:h0cBiP/","24576:0cBiP/0","24576:cBiP/0s","24576:BiP/0sJ","24576:iP/0sJv","24576:P/0sJvD","24576:/0sJvDw","24576:0sJvDwa","24576:sJvDwaY","24576:JvDwaYa","12288:2ypejtT","12288:ypejtTm","12288:pejtTmF","12288:ejtTmFe","12288:jtTmFe9","12288:tTmFe9V","12288:TmFe9Vq","12288:mFe9VqX","12288:Fe9VqXS","12288:e9VqXSG","12288:9VqXSGB","12288:VqXSGBc","12288:qXSGBcB","12288:XSGBcBi","12288:SGBcBiP","12288:GBcBiP/","12288:BcBiP/0","12288:BiP/0sB","12288:iP/0sBw","12288:P/0sBwa","12288:/0sBwaY","12288:0sBwaYa"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"image293.jpg.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":660992,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1515316594000,"last_seen":1677369698000,"last_multi_scan":1677369698000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":15,"suspicious_count":14,"malicious_count":6,"total":35},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.MSIL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Crypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1202153","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.MSILHeracles.55747","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.MSILHeracles.55747 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik.MFL trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 700000121 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.MSIL.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Packed-XL!7B3815B9A905","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Inject3.ewylzd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_97","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL.MUJ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Trojan.MSIL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.Win32.167024","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"MSILHeracles.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$25","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"\" queries volume information of \"C:\\\" at 00015612-00003496-0000010C-44941671","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\STEAMERRORREPORTER.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\STEAMERRORREPORTER.EXE\")\n \"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\6B872D1E949BD9D111168692301414BB685DC5C262FFAE6F55F34C8041DE0F5F.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\6B872D1E949BD9D111168692301414BB685DC5C262FFAE6F55F34C8041DE0F5F.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"172.217.19.238:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\284011b8-65b2-454a-80b6-07cf74c422f7\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"284011b8-65b2-454a-80b6-07cf74c422f7\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\d40b99d82652dbbc000d378a824ae296\\mscorlib.ni.dll\" at 69380000\n \"steamerrorreporter.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\d40b99d82652dbbc000d378a824ae296\\mscorlib.ni.dll\" at 69410000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"\" called \"WScript.Shell.1.CreateObject\" ... \n \"\" called \"WScript.Shell.1.CreateShortcut\" with result: \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\steamerrorreporter.npcyc44s.lnk\" ...","origin":"API Call","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"Shell_TrayWnd\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"steamerrorreporter.exe\" (UID: 00016245-00003716)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"steamerrorreporter.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"steamerrorreporter.npcyc44s.lnk\" has type \"MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Archive ctime=Sun Jan 7 17:10:53 2018 mtime=Sun Jan 7 17:10:53 2018 atime=Sun Jan 7 17:10:33 2018 length=660992 window=hide\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$26","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"\n Heuristic match: \"HEAD /edgedl/release2/Hcq1Yqsih2A/57.0.2987.133_56.0.2924.87_chrome_updater.exe HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityUser-Agent: Microsoft BITS/7.5X-Old-UID: cnt=0X-Last-HR: 0x80042194X-Last-HTTP-Status-Code: 404\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"steamerrorreporter.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"6b872d1e949bd9d111168692301414bb685dc5c262ffae6f55f34c8041de0f5f.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Process deletes itself","description":"\"%APPDATA%\\Microsoft\\Windows\\Templates\\steamerrorreporter.exe\" deletes itself","origin":"API Call","relevance":10,"id":"api-27","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00015612-00003496-00000105-43574810\n \"steamerrorreporter.exe\" at 00016245-00003716-00000105-45440550","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"\" is allocating memory with PAGE_GUARD access rights\n \"steamerrorreporter.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.73492239557","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"steamerrorreporter.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"steamerrorreporter.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"\" sleeping for \"1566804069\" milliseconds\n \"steamerrorreporter.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"\" read file \"C:\\Users\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"System.Core,3.5.0.0,,b77a5c561934e089,MSIL\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\6b872d1e949bd9d111168692301414bb685dc5c262ffae6f55f34c8041de0f5f.exe\" marked \"C:\\6b872d1e949bd9d111168692301414bb685dc5c262ffae6f55f34c8041de0f5f.exe:Zone.Identifier\" for deletion\n \"%APPDATA%\\Microsoft\\Windows\\Templates\\steamerrorreporter.exe\" marked \"%APPDATA%\\Microsoft\\Windows\\Templates\\steamerrorreporter.exe\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$27","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"08572d76047836760000000051c1a2759498a275ee9ca27575dca475273ea475efb2a8750000000046ce3675013d377538ed3775cfcd367531233675de2f3775c4ca367580bb3675aa6e37759fbb367592bb367546ba36750abf367500000000\" to virtual address \"0x6A5F1000\" (part of module \"SHFOLDER.DLL\")\n \"\" wrote bytes \"6740f8fa\" to virtual address \"0x69F21FDC\" (part of module \"MSCORWKS.DLL\")\n \"\" wrote bytes \"db4db87100000000\" to virtual address \"0x011D2000\" (part of module \"6B872D1E949BD9D111168692301414BB685DC5C262FFAE6F55F34C8041DE0F5F.EXE\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to hide tracks of having downloaded a file from the internet","description":"\"\" opened \"C:\\6b872d1e949bd9d111168692301414bb685dc5c262ffae6f55f34c8041de0f5f.exe:Zone.Identifier\" with delete access\n \"steamerrorreporter.exe\" opened \"%APPDATA%\\Microsoft\\Windows\\Templates\\steamerrorreporter.exe:Zone.Identifier\" with delete access","origin":"API Call","relevance":7,"id":"api-42","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"16/68 Antivirus vendors marked sample as malicious (23% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"16/68 Antivirus vendors marked sample as malicious (23% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"16/68 Antivirus vendors marked spawned process \"steamerrorreporter.exe\" (PID: 3716) as malicious (classified as \"DangerousObject.Multi\" with 23% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Scans for the windows taskbar (often used for explorer injection)","description":"\"\" searching for class \"Shell_TrayWnd\"","origin":"API Call","relevance":5,"id":"api-17","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"%APPDATA%\\Microsoft\\Windows\\Templates\\steamerrorreporter.exe\" (Handle: 636)\n \"\" wrote 52 bytes to a remote process \"%APPDATA%\\Microsoft\\Windows\\Templates\\steamerrorreporter.exe\" (Handle: 636)\n \"\" wrote 4 bytes to a remote process \"%APPDATA%\\Microsoft\\Windows\\Templates\\steamerrorreporter.exe\" (Handle: 636)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":62,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":45,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5a51e3fc7ca3e1401071c8d3","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"DangerousObject.Multi","contacted_countries":["USA"],"submit_name":"image293.jpg.exe","analysis_start_time":"2018-01-07T10:10:02+00:00","indicators_count":{"informative":15,"suspicious":18,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"172.217.19.238","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}],"processes":[{"pid":3496,"ppid":0,"name":"6b872d1e949bd9d111168692301414bb685dc5c262ffae6f55f34c8041de0f5f.exe","command_line":"","sha256":"6b872d1e949bd9d111168692301414bb685dc5c262ffae6f55f34c8041de0f5f","normalized_path":"C:\\6b872d1e949bd9d111168692301414bb685dc5c262ffae6f55f34c8041de0f5f.exe","uid":"00015612-00003496","icon":"$28"},{"pid":3716,"ppid":3496,"name":"steamerrorreporter.exe","command_line":"","sha256":"6b872d1e949bd9d111168692301414bb685dc5c262ffae6f55f34c8041de0f5f","normalized_path":"%APPDATA%\\Microsoft\\Windows\\Templates\\steamerrorreporter.exe","parent_uid":"00015612-00003496","uid":"00016245-00003716"}],"all_imported_dlls":["shlwapi.dll","imm32.dll","shell32.dll","usp10.dll","mscorjit.dll","cscapi.dll","Wldap32.dll","sspicli.dll","scrrun.dll","RpcRtRemote.dll","slc.dll","msvcrt.dll","lpk.dll","mscorwks.dll","oleaut32.dll","msasn1.dll","mscoreei.dll","profapi.dll","wininet.dll","cryptbase.dll","apphelp.dll","mscoree.dll","gdi32.dll","user32.dll","cryptsp.dll","ntmarta.dll","iertutil.dll","netutils.dll","mpr.dll","System.Drawing.ni.dll","System.Core.ni.dll","mscorrc.dll","Microsoft.VisualBasic.dll","sxs.dll","propsys.dll","cfgmgr32.dll","devobj.dll","linkinfo.dll","System.ni.dll","sechost.dll","ntshrui.dll","advapi32.dll","mscorlib.ni.dll","ole32.dll","version.dll","psapi.dll","crypt32.dll","comctl32.dll","urlmon.dll","kernel32.dll","KernelBase.dll","rpcrt4.dll","uxtheme.dll","clbcatq.dll","ntdll.dll","msctf.dll","msvcr80.dll","rsaenh.dll","srvcli.dll","System.Windows.Forms.ni.dll","shfolder.dll","setupapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"steamerrorreporter.npcyc44s.lnk","sha256":"e0a38afd27cf333df63663ea50233605ed63f7173e4663254b2bf5d7e65f6b7a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]}],"files_written":[{"path":"C:\\6b872d1e949bd9d111168692301414bb685dc5c262ffae6f55f34c8041de0f5f.exe.config","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"C:\\6b872d1e949bd9d111168692301414bb685dc5c262ffae6f55f34c8041de0f5f.exe","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%WINDIR%\\System32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\steamerrorreporter.npcyc44s.lnk\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%WINDIR%\\System32\\en-US\\wshom.ocx.mui","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\steamerrorreporter.npcyc44s.lnk","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Templates\\steamerrorreporter.exe.config","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index23c.dat","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%WINDIR%\\System32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\284011b8-65b2-454a-80b6-07cf74c422f7","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]},{"name":"284011b8-65b2-454a-80b6-07cf74c422f7","sources":[{"report_type":"sandbox","report_id":"5a51e3fc7ca3e1401071c8d3"}]}]}},"report_ids":{"sandbox_job_ids":["5a51e3fc7ca3e1401071c8d3"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious MSILHeracles.Generic Sample 6b872d1e949b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 6b872d1e949b…. Malware family: MSILHeracles.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6b872d1e949bd9d111168692301414bb685dc5c262ffae6f55f34c8041de0f5f"}],["$","meta","4",{"property":"og:title","content":"Malicious MSILHeracles.Generic Sample 6b872d1e949b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 6b872d1e949b…. Malware family: MSILHeracles.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6b872d1e949bd9d111168692301414bb685dc5c262ffae6f55f34c8041de0f5f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious MSILHeracles.Generic Sample 6b872d1e949b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 6b872d1e949b…. Malware family: MSILHeracles.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]